Commit 59063afa authored by Inaky Perez-Gonzalez's avatar Inaky Perez-Gonzalez

wimax/i2400m: fix oops when the TX FIFO fills up due to a missing check

When the TX FIFO filled up and i2400m_tx_new() failed to allocate a
new TX message header, a missing check for said condition was causing a
kernel oops when trying to dereference a NULL i2400m->tx_msg pointer.

Found and diagnosed by Cindy H. Kao.
Signed-off-by: default avatarInaky Perez-Gonzalez <inaky@linux.intel.com>
parent b4bd07e3
...@@ -653,6 +653,8 @@ int i2400m_tx(struct i2400m *i2400m, const void *buf, size_t buf_len, ...@@ -653,6 +653,8 @@ int i2400m_tx(struct i2400m *i2400m, const void *buf, size_t buf_len,
i2400m_tx_close(i2400m); i2400m_tx_close(i2400m);
i2400m_tx_new(i2400m); i2400m_tx_new(i2400m);
} }
if (i2400m->tx_msg == NULL)
goto error_tx_new;
if (i2400m->tx_msg->size + padded_len > I2400M_TX_BUF_SIZE / 2) { if (i2400m->tx_msg->size + padded_len > I2400M_TX_BUF_SIZE / 2) {
d_printf(2, dev, "TX: message too big, going new\n"); d_printf(2, dev, "TX: message too big, going new\n");
i2400m_tx_close(i2400m); i2400m_tx_close(i2400m);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment